Government websites have always been exposed to automated scanning, credential attacks and attempts to exploit vulnerable software. What is changing is the capability behind some of that activity. Autonomous AI systems can interpret websites, navigate unfamiliar interfaces, search for weaknesses and adapt their next actions without a human specifying every step. That makes a public-facing government portal more than a passive target: it can become an environment in which an AI system continuously tests what it can discover and do.
Recent incidents illustrate why the issue matters beyond any single country. In September 2026, researchers reported that AI agents had attempted to access Canada’s Library and Archives Canada website; Canada’s Cyber Centre said it was aware of the activity and that no compromise had been identified. The reports followed disclosures involving government systems in Australia and the United States. These incidents do not mean government websites are uniquely vulnerable to AI, nor that every automated request is an attack. They demonstrate, however, that AI-assisted discovery can make reconnaissance faster, more adaptive and potentially more persistent.
Why public websites are attractive targets
A government website is usually designed to be reachable.
That sounds obvious, but it creates an unusual security environment. Public portals must accept traffic from unknown users, expose functionality through web interfaces and APIs, support large numbers of users and often remain available continuously.
Many also connect the public-facing layer to deeper systems: databases, identity services, payment platforms, document repositories, administrative applications or third-party services.
An attacker does not necessarily need to compromise the homepage to cause serious damage. A weakness in a less visible API, legacy application, authentication mechanism or integration may provide the more valuable route.
This makes government websites particularly interesting to automated discovery systems. An AI agent does not need to know the organization’s architecture in advance. It can potentially learn from the site’s responses, documentation, visible functionality and errors, then adjust its next request.
That is fundamentally different from a fixed scanner following a predetermined list of tests.
AI changes the economics of vulnerability discovery
Automated vulnerability scanning is not new. Security teams and attackers have used scanners, fuzzers and scripts for years.
The difference is that AI can increasingly combine several activities that previously required separate tools or substantial human interpretation.
An autonomous system can potentially:
- Understand the purpose of a webpage or API
- Identify interesting functionality
- Generate test cases
- Interpret responses
- Notice inconsistencies
- Modify its approach
- Search documentation or public code for context
- Connect findings from different parts of a system
- Continue investigating when an initial approach fails
The UK Government Digital Service and Department for Science, Innovation and Technology warned in 2026 that advances in AI-assisted vulnerability detection could shorten the period between vulnerability discovery and exploitation. Its guidance emphasizes that the underlying weakness—such as an unpatched vulnerability, insecure implementation or unsafe configuration—remains the primary problem, while AI can reduce the time and uncertainty involved in finding it.
That distinction matters.
AI does not magically create vulnerabilities in a secure website. It can make existing weaknesses easier to discover and potentially easier to investigate at scale.
Legacy systems are an especially important concern
Public-sector technology environments often evolve over many years.
A government department may have modern cloud services sitting alongside applications developed under completely different technical assumptions. Some systems may depend on old frameworks, custom integrations or software that few current employees understand in detail.
This creates what might be called a security knowledge gap.
The people maintaining a system may know that it works, but not necessarily remember why a particular endpoint exists, which external application depends on it or what security assumption was made when it was introduced.
An automated system does not need that institutional history.
It can simply interact with what is exposed and look for unusual responses.
That makes asset inventories, dependency management and continuous vulnerability remediation more important as AI-driven discovery improves.
The UK’s 2026 public-sector guidance reaches a similar conclusion: organizations should focus on secure-by-design development, automated security hygiene and credible remediation capability rather than assuming that hiding source code will solve the problem.
Public-facing portals reveal more than administrators may realize
A website can expose information without an obvious data breach.
Error messages can reveal software components. API responses can disclose object identifiers. Documentation can reveal how systems communicate. Public JavaScript can reveal application logic. Search functions can reveal how data is structured.
None of these automatically represents a vulnerability.
But collectively, they can reduce the uncertainty an attacker faces.
AI systems are particularly well suited to processing large amounts of this material. Instead of a person manually reading hundreds of pages, an agent can potentially classify endpoints, identify patterns and determine which areas deserve additional investigation.
That is why governments should think about information exposure as part of attack-surface management, without assuming that every piece of public information must be hidden.
The UK’s government guidance explicitly rejects treating source-code secrecy as a substitute for security. It notes that attackers can discover weaknesses through running services, fuzzing, binary analysis and dependency analysis even when source code is private.
The more durable defense is to make the publicly accessible system robust enough to withstand that scrutiny.
AI agents are different from traditional scanners
A conventional vulnerability scanner might send a known test, compare the response against expected behavior and report a possible vulnerability.
An AI agent can potentially operate more like an investigator.
It can form a hypothesis, test it, interpret the result and decide what to investigate next.
That adaptability is useful for defenders too. Singapore’s Cyber Security Agency and government technology agencies tested AI agents on government websites in a 2025–2026 sandbox, finding that agents could perform quality-assurance tasks such as checking response times, search functions, page integrity and mismatches involving staging URLs.
The same capability that helps a government test its own systems can potentially help someone else examine them.
This creates a recurring feature of AI security: the technology is dual-use.
The appropriate response is not to assume that automated discovery itself is malicious. It is to make sure that defenders can discover weaknesses at least as quickly as outsiders can.
What changes when an agent can act autonomously
The greatest concern is not necessarily AI finding a vulnerability.
It is what happens next.
A discovery system that reports a suspicious endpoint to a security analyst is one thing. An autonomous system that can decide to continue testing, create new requests, interact with additional services or attempt to exploit a weakness is another.
NIST describes AI agents as systems capable of planning and taking autonomous actions that affect real-world systems. Its 2026 work on agent security identifies risks arising from the combination of AI model outputs with software functionality, including indirect prompt injection and situations where models take harmful actions even without an adversarial input.
That means public-sector security teams need to consider not only “Can someone find this weakness?” but also “How much can an autonomous system do after it finds it?”
| Government-system characteristic | Why autonomous AI makes it more important | Defensive priority |
|---|---|---|
| Publicly accessible services | Agents can continuously interact with exposed functionality | External attack-surface monitoring |
| Legacy applications | Older weaknesses may be easier to identify automatically | Prioritized remediation and compensating controls |
| Complex APIs | Agents can explore relationships between endpoints and responses | API authentication, authorization and validation |
| Public documentation or source code | AI can process large amounts of technical information quickly | Remove secrets and sensitive operational details; secure the underlying system |
| Multiple connected systems | A weakness in one service may provide information about another | Segmentation and tightly controlled service identities |
| Slow patching processes | Automated discovery can compress the time available for remediation | Risk-based patch SLAs and rapid mitigation |
| Agent-enabled internal tools | Compromised agents may themselves become an attack path | Least privilege, monitoring and human approval for high-impact actions |
The remediation window may be getting shorter
Historically, organizations often had some time between a vulnerability becoming known and attackers exploiting it.
That window has never been guaranteed, and automated exploitation has already compressed it in many areas.
AI could compress it further by reducing the amount of human effort required to understand unfamiliar systems.
This changes the economics of defensive maintenance.
A vulnerability that takes a skilled researcher several days to understand may become much less expensive to investigate when an AI system can perform portions of the analysis automatically.
That does not mean every vulnerability will suddenly be exploited. Real-world exploitation still depends on factors such as access, system configuration, authentication requirements, exploit reliability and the value of the target.
But it strengthens the case for treating remediation speed as a security capability in its own right.
The UK government guidance makes this point explicitly, recommending patch service-level agreements, automated dependency and vulnerability management, and the ability to respond quickly to incoming vulnerability reports.
Government websites need continuous external visibility
A security assessment performed once a year cannot tell an agency what its internet-facing environment looks like today.
Public-sector organizations should maintain an authoritative inventory of externally accessible assets and continuously monitor for changes.
That includes more than obvious websites.
Security teams should account for:
- Internet-facing APIs
- Subdomains
- Cloud-hosted applications
- Authentication endpoints
- Development and staging systems accidentally exposed to the internet
- Legacy portals
- Third-party services operating under government domains
- Forgotten applications and abandoned infrastructure
The objective is not simply to identify what the organization intended to publish.
It is to identify what the internet can actually reach.
This distinction becomes more important as automated discovery systems become capable of finding connections that humans may overlook.
Public information is not the same as sensitive information
The growth of AI-powered reconnaissance could tempt governments to hide more of their technical information.
That can be counterproductive.
The UK’s 2026 guidance recommends continuing to keep government source code open by default, while applying explicit exceptions where publication creates a specific and credible additional route to harm. It also stresses that repositories should never contain secrets such as credentials, API keys or private keys.
The underlying principle is useful beyond source code:
Do not try to secure a weak system by making it harder to see. Secure the system itself.
A public API should enforce authorization even if its documentation is public. A web application should validate inputs even if its source code is visible. Credentials should remain secret regardless of whether an attacker can inspect the application.
Security through obscurity can sometimes provide an incremental benefit, but it should not become the primary control.
The defensive opportunity is also significant
The same technology creating concern for government security teams can improve government security.
AI agents can potentially help organizations perform continuous quality assurance, identify anomalous behavior, analyze vulnerabilities and prioritize remediation.
Singapore’s government-led AI Agents Sandbox provides an example of this defensive direction. Its testing found that agents could assess aspects of government websites that would otherwise require manual quality-assurance work.
This suggests an emerging contest between automated discovery and automated defense.
The important question is not whether governments should use AI defensively. It is how much authority defensive agents should receive.
An AI system that identifies a potentially vulnerable service can create a ticket and recommend a fix without being permitted to modify production infrastructure. A more advanced system might test a controlled environment automatically while requiring human approval before making changes to a live public service.
That separation reduces the consequences of an AI mistake.
The agent itself becomes a security boundary
Government agencies also need to secure the AI tools they deploy internally.
An AI coding assistant with access to source repositories, for example, may become a sensitive identity in its own right. An automated security-testing agent may have credentials that allow it to scan internal systems. A service-management agent may be able to modify configuration or create accounts.
NIST’s current work on agent identity and authorization warns that traditional identity-management approaches may not fully address autonomous systems. Its proposed direction emphasizes strong identity, authorization and governance for agents rather than treating them simply as extensions of human users.
That means every government agency experimenting with autonomous AI should be able to answer basic questions:
Which agent is acting? What credentials does it have? What can those credentials access? Which actions require human approval? What is logged? And how quickly can its authority be revoked?
If those questions cannot be answered, the system is not ready for unrestricted autonomy.
What public-sector security teams should prioritize
The immediate response to AI-powered discovery should not be a blanket shutdown of public services.
It should be a strengthening of the fundamentals that AI makes more consequential.
Government technology leaders should prioritize:
- Know the external attack surface. Maintain a current inventory of internet-facing systems and APIs.
- Fix weaknesses quickly. Prioritize vulnerabilities according to exploitability and potential impact, not simply the number of findings.
- Retire or isolate obsolete systems. Legacy infrastructure that cannot be adequately secured should not remain broadly connected without compensating controls.
- Protect identities and APIs. Strong authentication, authorization and narrowly scoped service credentials limit what an attacker can accomplish after discovery.
- Separate systems. Network and application segmentation can prevent a weakness in one public service from becoming access to unrelated government infrastructure.
- Monitor for unusual behavior. Automated probing may generate patterns that differ from normal public usage, although detection should account for legitimate research and security testing.
- Test continuously. Use automated security testing and controlled AI-assisted assessment to identify weaknesses before attackers do.
- Prepare for rapid containment. Teams should know how to disable vulnerable functions, revoke credentials and isolate affected services without unnecessarily taking entire digital-government platforms offline.
These measures align closely with joint guidance from Australian cyber authorities and international partners, which recommends incremental adoption of agentic AI, strict privilege controls, strong identity management, continuous monitoring and human oversight.
Why this matters beyond government
Government websites make the issue visible because they are public, heavily used and often connected to services that citizens depend on.
But the underlying risk is not uniquely governmental.
Banks, hospitals, universities, utilities, retailers and large businesses operate similarly exposed systems. Many also maintain combinations of modern cloud services and older applications.
The same AI capabilities that can map a government portal can examine a commercial application.
The difference is often only the target’s value and the consequences of disruption.
Organizations that want to understand the next stage of this risk should also consider how AI systems themselves become operational actors. The broader security implications are explored in AI Security’s New Front Line: What Happens When an AI Agent Can Touch Your Systems?, particularly where agents can interact with external systems rather than simply generate information.
The evolution is also connected to the wider shift from passive AI tools toward systems that participate directly in online environments, discussed in Evolution of AI Agents into Internet Actors: Passive Tools are now Active Participants.
The real weakness is the time between discovery and response
Government websites are unlikely to stop being targets simply because AI agents have become more capable. Public services have to remain accessible, and attackers have always had incentives to examine them.
What is changing is the speed at which a capable automated system can move from “What does this service do?” to “Where might it be weak?”
That makes resilience increasingly dependent on the speed and discipline of the defender.
The most important investment may therefore not be another perimeter product. It may be the ability to discover exposed assets continuously, identify weaknesses quickly, patch or isolate them rapidly and maintain enough visibility to understand what is happening.
AI can accelerate vulnerability discovery. Governments can use AI to accelerate discovery and remediation as well.
The strategic advantage will belong to organizations that make their public-facing systems difficult to exploit, easy to monitor and fast to repair—not organizations that simply hope autonomous systems will fail to find what is already exposed.